Intermediate LevelCloud Computing (AWS/GCP/Azure)
How do VPC Flow Logs capture network traffic IP data for security analysis?
❓ Interview Prompt: Explain AWS VPC Flow Logs, accepted vs rejected traffic recording, CloudWatch Insights queries, and S3 delivery.
AWS VPC Flow Logs is a feature that enables you to capture IP traffic information flowing to and from network interfaces (ENIs) in your VPC.
Recorded Fields:
Captures src/dst IP addresses, src/dst ports, protocol (TCP/UDP), packet count, byte volume, and action status ('ACCEPT' or 'REJECT').
Key Use Cases:
1
Security Auditing: Detecting unauthorized port scans or traffic reaching rejected NACL rules.
2
Troubleshooting: Diagnosing why an EC2 instance cannot connect to a database (checking if traffic shows 'REJECT' due to Security Group misconfiguration).
3
CloudWatch Insights: Running fast SQL-like queries over flow logs to identify top talker IP addresses.
Code Implementation Example
sql
-- CloudWatch Logs Insights query finding top rejected IP addresses from VPC Flow Logs
fields @timestamp, srcAddr, dstAddr, dstPort, action
| filter action = 'REJECT'
| stats count(*) as rejectedCount by srcAddr
| sort rejectedCount desc
| limit 10💡CloudWatch Logs Insights query querying top rejected traffic sources in VPC Flow Logs.
🎯 Interview Key Takeaway
VPC Flow Logs record accepted and rejected network traffic IP metrics for security auditing and network troubleshooting.
#VPC Flow Logs#Networking#CloudWatch#Security#Intermediate
Back to all Cloud Computing (AWS/GCP/Azure) Questions→